test(#123): add Vitest integration tests for SvelteKit load functions

Adds server-project spec files for the four priority routes:
- routes/+page.server (home/search) — happy path, 401 redirect, network error fallback
- routes/documents/[id]/+page.server — happy path, comments fetch failure, 401/403/404
- routes/persons/[id]/+page.server — happy path, partial API failure, 403/404
- routes/admin/+page.server — ADMIN permission gate (none/read-only/undefined/no groups)

All tests run in Node environment with vi.mock() for createApiClient and
$env/dynamic/private. No real network calls; total suite runs in < 1 second.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/documents/[id]/page.server.spec.ts

@@ -0,0 +1,126 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+
+vi.mock('$lib/api.server', () => ({ createApiClient: vi.fn() }));
+vi.mock('$env/dynamic/private', () => ({ env: { API_INTERNAL_URL: 'http://test-backend:8080' } }));
+
+import { load } from './+page.server';
+import { createApiClient } from '$lib/api.server';
+
+beforeEach(() => vi.clearAllMocks());
+
+function makeCommentsResponse(comments: unknown[]) {
+	return {
+		ok: true,
+		json: vi.fn().mockResolvedValue(comments)
+	};
+}
+
+// ─── happy path ───────────────────────────────────────────────────────────────
+
+describe('document detail load — happy path', () => {
+	it('returns document and comments on success', async () => {
+		vi.mocked(createApiClient).mockReturnValue({
+			GET: vi.fn().mockResolvedValue({
+				response: { ok: true, status: 200 },
+				data: { id: '123', title: 'Testbrief' }
+			})
+		} as ReturnType<typeof createApiClient>);
+
+		const mockFetch = vi.fn().mockResolvedValue(makeCommentsResponse([{ id: 'c1', body: 'Hi' }]));
+
+		const result = await load({
+			params: { id: '123' },
+			fetch: mockFetch as unknown as typeof fetch
+		});
+
+		expect(result.document.title).toBe('Testbrief');
+		expect(result.comments).toHaveLength(1);
+	});
+
+	it('returns empty comments when the comments fetch fails', async () => {
+		vi.mocked(createApiClient).mockReturnValue({
+			GET: vi.fn().mockResolvedValue({
+				response: { ok: true, status: 200 },
+				data: { id: '123', title: 'Testbrief' }
+			})
+		} as ReturnType<typeof createApiClient>);
+
+		// fetch throws a network error for the comments endpoint
+		const mockFetch = vi.fn().mockRejectedValue(new Error('Network error'));
+
+		const result = await load({
+			params: { id: '123' },
+			fetch: mockFetch as unknown as typeof fetch
+		});
+
+		expect(result.document.title).toBe('Testbrief');
+		expect(result.comments).toEqual([]);
+	});
+
+	it('returns empty comments when the comments response is not ok', async () => {
+		vi.mocked(createApiClient).mockReturnValue({
+			GET: vi.fn().mockResolvedValue({
+				response: { ok: true, status: 200 },
+				data: { id: '123', title: 'Testbrief' }
+			})
+		} as ReturnType<typeof createApiClient>);
+
+		const mockFetch = vi.fn().mockResolvedValue({ ok: false });
+
+		const result = await load({
+			params: { id: '123' },
+			fetch: mockFetch as unknown as typeof fetch
+		});
+
+		expect(result.comments).toEqual([]);
+	});
+});
+
+// ─── error paths ──────────────────────────────────────────────────────────────
+
+describe('document detail load — error paths', () => {
+	it('throws 404 when document does not exist', async () => {
+		vi.mocked(createApiClient).mockReturnValue({
+			GET: vi.fn().mockResolvedValue({
+				response: { ok: false, status: 404 },
+				error: null
+			})
+		} as ReturnType<typeof createApiClient>);
+
+		const mockFetch = vi.fn().mockResolvedValue({ ok: false });
+
+		await expect(
+			load({ params: { id: 'missing' }, fetch: mockFetch as unknown as typeof fetch })
+		).rejects.toMatchObject({ status: 404 });
+	});
+
+	it('throws 403 when document is forbidden', async () => {
+		vi.mocked(createApiClient).mockReturnValue({
+			GET: vi.fn().mockResolvedValue({
+				response: { ok: false, status: 403 },
+				error: null
+			})
+		} as ReturnType<typeof createApiClient>);
+
+		const mockFetch = vi.fn().mockResolvedValue({ ok: false });
+
+		await expect(
+			load({ params: { id: 'secret' }, fetch: mockFetch as unknown as typeof fetch })
+		).rejects.toMatchObject({ status: 403 });
+	});
+
+	it('redirects to /login on 401', async () => {
+		vi.mocked(createApiClient).mockReturnValue({
+			GET: vi.fn().mockResolvedValue({
+				response: { ok: false, status: 401 },
+				error: null
+			})
+		} as ReturnType<typeof createApiClient>);
+
+		const mockFetch = vi.fn().mockResolvedValue({ ok: false });
+
+		await expect(
+			load({ params: { id: 'any' }, fetch: mockFetch as unknown as typeof fetch })
+		).rejects.toMatchObject({ location: '/login' });
+	});
+});